* extract subject id in boxoauth detector
* update the detector design for subject id handling
* verify subject ID via CCG auth before populating AnalysisInfo
Instead of blindly pairing every found subject ID with verified
credentials, use the Box CCG token endpoint to verify which subject ID
actually works. Emit one result per credential pair with only the
verified subject ID in AnalysisInfo. Add gock-based tests for all
AnalysisInfo scenarios.
* replace analysisinfo with secretparts
* [INS-379] Populate SecretParts unconditionally in BoxOauth detector
Always set client_id and client_secret in SecretParts regardless of
verification status. subject_id is added only when a valid triplet is
confirmed via verifySubjectID. Previously SecretParts was only populated
for a fully verified triple, leaving unverified results with no
credential data stored.
* address bugbot comment; Non-deterministic map iteration for subject ID selection
---------
Co-authored-by: Charlie Gunyon <[email protected]>
